PL EN
Book a meeting
Chapter 2Data Subject’s Rights
  1. Chapter 1Basic Compliance
  2. Chapter 2Data Subject’s Rights
  3. Chapter 3Security
  4. Chapter 4Data Processing
  5. Chapter 5Managing Incidents and Data Breaches
  6. Chapter 6Data Protection Officer (DPO)
  7. Chapter 7The Regulator
  8. Chapter 8Legal Remedies, Liability, Administrative Sanctions
  9. Appendix IPersonal Data Protection Policy
  10. Appendix IIData Processing Agreement
  11. Appendix IIIJoint Controllership Agreement
Section 2.7
  1. 2.1Processing Data Subject’s Rights and Requests (Article 12 of the GDPR)
  2. 2.2Right to Be Informed and Privacy Information Obligation (Articles 13 and 14 GDPR)
  3. 2.3Right of Access to Data and to a Copy of Data (Article 15 GDPR)
  4. 2.4Right to Rectification of Data (Article 16 GDPR)
  5. 2.5The Right to Erasure (Right to Be Forgotten) (Article 17 GDPR)
  6. 2.6Right to Restriction of Processing (Article 18 GDPR)
  7. 2.7Obligation to Notify about Rectifying, Erasing, or Restricting of Processing of Data (Article 19 GDPR)
  8. 2.8Right to Data Portability, i.e. How to Transfer Data from One Controller to Another (Article 20 GDPR)
  9. 2.9The Right to Object (Article 21 GDPR)
  10. 2.10Profiling and Automated Decision-Making (Article 22 GDPR)

Obligation to Notify about Rectifying, Erasing, or Restricting of Processing of Data (Article 19 GDPR)

Aleksander P. Czarnowski, Katarzyna Kunda, Maciej Gawronski, Michał Kibil, Michał Sztaberek & Paweł Punda

#7.1 Duty to Follow Your Data

The controller should remember about the obligation provided for in Article 19 GDPR to notify about the restriction of data processing to ‘each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort’.

The controller is also required to inform the person exercising the right to restriction of processing about the recipients subject to the restriction if the data subject so requests.

Both of these obligations will be a subject examined during a supervisory authority inspection and therefore should be taken seriously.

Article 19 GDPR in practice requests from the data controller to follow their data. The data controller should know who they make data available to, to be able to inform those entities about data rectification/restriction/erasure as well as to let the data subject know who has received hose ‘faulty data’ of those.

#7.2 ‘Recipient’ of Data under Article 19 GDPR

We believe that ‘recipient’ of data referred to in Article 19 GDPR is not the same ‘recipient’ as defined in Article 4(9) GDPR. The definition of ‘recipient’ contained in Article 4(9) GDPR is very broad, covering data processors, though excluding public authorities when they request data for specific proceedings.

If we would apply the definition of ‘recipient’ from Article 4(9) GDPR strictly to Article 19 GDPR, the data controller would have to inform the data subject about the identity of data processors (subcontractors of the data controller – which makes no sense and which would lead to disclosing trade secrets). At the same time, the data controller would not have to inform the Police about changes to the data previously passed to the Police on a specific request (which makes even less sense).

Therefore, we believe Article 19 GDPR does not require the data controller to inform the data subject about data processors but at the same time requires the data subject to inform public authorities which obtained data subject to rectification/erasure/restriction (that does not mean that public authorities would be under the duty to comply with rectification/erasure/restriction requests).